Skip to main content

Insecure or unset HTTP headers - X-Frame Options

Need​

Implementation of a more secure and effective protection mechanism against clickjacking

Context​

  • Usage of Java for building cross-platform applications
  • Usage of HttpServletResponse for handling HTTP responses in Java Servlets

Description​

Non compliant code​

import javax.servlet.http.HttpServletResponse;

public void setHeader(HttpServletResponse response) {
    response.addHeader("X-Frame-Options", "SAMEORIGIN");
}

In the above code snippet, the application is setting the HTTP header 'X-Frame-Options' to 'SAMEORIGIN'. This means that the application is allowing the browser to render the page in a <frame>, <iframe> or <object> only if the domain is the same as the one serving the page. This is a mechanism to protect against clickjacking attacks.

However, this method of protection is considered deprecated because it can be bypassed using several iframe layers. If an attacker is able to load the application within an iframe on a malicious website, they could trick the user into clicking on invisible buttons or links, leading to unintended actions being performed on the application.

Therefore, relying solely on the 'X-Frame-Options' header for clickjacking protection exposes the application to potential security vulnerabilities. It's recommended to use more modern security mechanisms, such as Content Security Policy (CSP), in addition to 'X-Frame-Options' to ensure robust protection against clickjacking attacks.

Steps​

  • Replace the use of X-Frame-Options header with Content-Security-Policy header.
  • Set the Content-Security-Policy header to include the 'frame-ancestors' directive with the 'self' value.
  • Ensure that the Content-Security-Policy header is set on all server responses.
  • Test the application to ensure that the clickjacking vulnerability is mitigated.

Compliant code​

import javax.servlet.http.HttpServletResponse;

public void setHeader(HttpServletResponse response) {
    response.addHeader("Content-Security-Policy", "frame-ancestors 'self'");
}

The previous code was vulnerable to clickjacking attacks because it was using the deprecated X-Frame-Options header as the only protection mechanism. This header can be bypassed using several iframe layers, making it an insecure method of protection.

The updated code replaces the X-Frame-Options header with the Content-Security-Policy header. This header is more secure and cannot be bypassed in the same way. The Content-Security-Policy header is set to include the frame-ancestors directive with the 'self' value. This means that the page can only be embedded by a page of the same origin, effectively preventing clickjacking attacks.

It's important to ensure that the Content-Security-Policy header is set on all server responses to provide consistent protection across the application.

After implementing these changes, it's recommended to test the application to ensure that the clickjacking vulnerability is effectively mitigated.

References​

Last updated on